Description
The disable_functions feature in PHP 4 and 5 allows attackers to bypass intended restrictions by using an alias, as demonstrated by using ini_alter when ini_set is disabled.
Remediation
References
Related Vulnerabilities
SugarCRM Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2019-17299)
WordPress Plugin UpdraftPlus WordPress Backup Cross-Site Request Forgery (1.22.24)
PHP Use of Externally-Controlled Format String Vulnerability (CVE-2015-8617)